https://github.com/penvirus/macho_parser
MachO binary parser
https://github.com/penvirus/macho_parser
macho-parser macosx
Last synced: about 1 year ago
JSON representation
MachO binary parser
- Host: GitHub
- URL: https://github.com/penvirus/macho_parser
- Owner: penvirus
- License: bsd-3-clause
- Created: 2017-05-19T04:53:45.000Z (about 9 years ago)
- Default Branch: master
- Last Pushed: 2017-06-07T08:08:58.000Z (about 9 years ago)
- Last Synced: 2025-05-13T02:16:19.752Z (about 1 year ago)
- Topics: macho-parser, macosx
- Language: Python
- Homepage:
- Size: 4.88 KB
- Stars: 8
- Watchers: 1
- Forks: 5
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# macho_parser
This macho parser is intentionally incomplete. If you have any feature request, please contact me. I could enhance the module if I have time :-)
In addition to parse common meta data of Mach-O, I used it mainly to retrieve "purposely hidden" information within the MachO binary. See the following examples to learn more.
NOTE: little-endian
# APIs
## get_header()
return a namedtuple regarding to a Mach-O header for either 32-bit and 64-bit
## get_load_commands()
return a generator for each load commands
## get_segments()
return a generator for each segments for either LC_SEGMENT or LC_SEGMENT_64
## get_sections()
return a generator for each sections for either SECTION or SECTION_64
## get_section_data(segname, sectname)
return the data within specific segment and specfic section
# Examples
C source code to put some information into Mach-O structure
```
#include
static char str[] __attribute__ ((section("__EXAMPLE_SEG,__example_sect"))) = "Hello World!";
int main()
{
printf("%s\n", str);
return 0;
}
```
compile the program
```
$ clang -segprot __EXAMPLE_SEG rwx r example.c
```
Note: the -segprot tell clang to make the segment read-only
retrieve the header
```
>>> from macho_parser.macho_parser import MachO
>>> with MachO('/tmp/a.out') as m:
... print m.get_header()
...
mach_header_64(magic=4277009103, cputype=16777223, cpusubtype=-2147483645, filetype=2, ncmds=16, [snip]
```
list each load commands
```
>>> with MachO('/tmp/a.out') as m:
... for lc in m.get_load_commands():
... print lc
...
load_command(cmd=25, cmdsize=72)
load_command(cmd=25, cmdsize=472)
load_command(cmd=25, cmdsize=232)
load_command(cmd=25, cmdsize=152)
load_command(cmd=25, cmdsize=72)
load_command(cmd=2147483682, cmdsize=48)
load_command(cmd=2, cmdsize=24)
load_command(cmd=11, cmdsize=80)
load_command(cmd=14, cmdsize=32)
load_command(cmd=27, cmdsize=24)
load_command(cmd=36, cmdsize=16)
load_command(cmd=42, cmdsize=16)
load_command(cmd=2147483688, cmdsize=24)
load_command(cmd=12, cmdsize=56)
load_command(cmd=38, cmdsize=16)
load_command(cmd=41, cmdsize=16)
```
list each segments
```
with MachO('/tmp/a.out') as m:
... for seg in m.get_segments():
... print seg
...
segment_command_64(cmd=25, cmdsize=72, segname='__PAGEZERO\x00\x00\x00\x00\x00\x00',[snip]
segment_command_64(cmd=25, cmdsize=472, segname='__TEXT\x00\x00\x00\x00\x00\x00\x00[snip]
segment_command_64(cmd=25, cmdsize=232, segname='__DATA\x00\x00\x00\x00\x00\x00\x00[snip]
segment_command_64(cmd=25, cmdsize=152, segname='__EXAMPLE_SEG\x00\x00\x00',[snip]
segment_command_64(cmd=25, cmdsize=72, segname='__LINKEDIT\x00\x00\x00\x00\x00\x00',[snip]
```
list each sections
```
>>> with MachO('/tmp/a.out') as m:
... for sect in m.get_sections():
... print sect
...
section_64(sectname='__text\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', segname='__TEXT\x00[snip]
section_64(sectname='__stubs\x00\x00\x00\x00\x00\x00\x00\x00\x00', segname='__TEXT\x00[snip]
section_64(sectname='__stub_helper\x00\x00\x00', segname='__TEXT\x00\x00\x00\x00\x00[snip]
section_64(sectname='__cstring\x00\x00\x00\x00\x00\x00\x00', segname='__TEXT\x00\x00[snip]
section_64(sectname='__unwind_info\x00\x00\x00', segname='__TEXT\x00\x00\x00\x00\x00[snip]
section_64(sectname='__nl_symbol_ptr\x00', segname='__DATA\x00\x00\x00\x00\x00\x00[snip]
section_64(sectname='__la_symbol_ptr\x00', segname='__DATA\x00\x00\x00\x00\x00\x00[snip]
section_64(sectname='__example_sect\x00\x00', segname='__EXAMPLE_SEG\x00\x00\x00'[snip]
```
retrieve data within __EXAMPLE_SEG.__example_sect
```
>>> with MachO('/tmp/a.out') as m:
... print m.get_section_data('__EXAMPLE_SEG', '__example_sect')
...
Hello World!
```
# Links
https://pypi.python.org/pypi/macho_parser